Use of policy levels to enforce enterprise control

• US 20060225123A1
• Filed: 04/01/2005
• Published: 10/05/2006
• Est. Priority Date: 04/01/2005
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Kumhyr, David Bruce, Childress, Rhonda L., Pennell, Neil Raymond, Keel, Alan James
• Granted Patent: US 7,490,349 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A system and method for using hierarchical policy levels for distribution of software in a computer network. In one embodiment, computers of the network are arranged into a hierarchy. A management policy server with access to the network queries the hierarchy to identify computers at or below its own level within the hierarchy. Once a set of computers is identified, software programs, updates or policies are distributed, bypassing human intervention.

Claims

1. A method in a data processing system for managing software and policies in a computer network, comprising the steps of:

inventorying a set of computers in the network, wherein the set of computers are arranged into a hierarchy and wherein management policy software is installed at the data processing system for management software;

determining at least one computer in the set of computers is subject to management authority of the data processing system according to the hierarchy; and

responsive to a determination that the data processing system has management authority over the at least one computer in the set of computers, managing distribution of software and policies to the at least one computer in the set of computers.

2. The method of claim 1, further comprising:

determining a version of the software already present on the at least one computer in the set of computers.

3. The method of claim 1, wherein the data processing system distributes software configuration policy to the at least one computer in the set of computers.

4. The method of claim 1, wherein the step of determining at least one computer in the set of computers is subject to management authority of the data processing system according to the hierarchy comprises:

determining a status of the at least one computer in the set of computers, wherein the status comprises at least one of managed or unmanaged and at least one of shared or dedicated.

5. The method of claim 1, wherein the hierarchy is established according to predefined levels of management policy software resident at respective computers within the network corresponding to levels within the hierarchy.

6. The method of claim 2, wherein, responsive to a determination of an absence of any version of the software on the at least one computer in the set of computers, selectively initiating installation of the software.

7. The method of claim 1, further comprising:

responsive to a determination that management policy software is not resident in the at least one computer in the set of computers, communicating with the at least one computer in the set of computers through an adapter.

8. The method of claim 1, wherein the management authority is only for a selected software program on the at least one computer in the set of computers.

9. (canceled)

10. (canceled)

11. (canceled)

12. (canceled)

13. (canceled)

14. A computer program product in a computer readable medium, comprising:

first instructions for inventorying a set of computers in a network, wherein the set of computers are arranged into a hierarchy and wherein management policy software is installed at a data processing system for management software;

second instructions for determining at least one computer in the set of computers is subject to management authority of the data processing system according to the hierarchy; and

third instructions, responsive to a determination that the data processing system has management authority over the at least one computer in the set of computers, for managing distribution of software and policies to the at least one computer in the set of computers.

15. The computer program product of claim 14, further comprising:

fourth instructions for determining a version of the software already present on the at least one computer in the set of computers.

16. The computer program product of claim 14, wherein the data processing system distributes software configuration policy to at least one computer of the set of computers.

17. The computer program product of claim 14, wherein the step of determining at least one computer in the set of computers is subject to management authority of the data processing system according to the hierarchy comprises:

determining a status of the at least one computer in the set of computers, wherein the status comprises at least one of managed or unmanaged and at least one of shared or dedicated.

18. A data processing system for managing software and policies in a computer network, comprising:

an inventorying mechanism for inventorying a set of computers in the network, wherein the set of computers is arranged into a hierarchy and wherein management policy software is installed on the data processing system for management software;

a determining mechanism for determining at least one computer in the set of computers is subject to management authority of the data processing system according to the hierarchy; and

a managing mechanism, responsive to a determination that the data processing system has management authority over the at least one computer in the set of computers, for managing the distribution of software and policies to the at least one computer in the set of computers.

19. The data processing system of claim 18, wherein the data processing system distributes software configuration policy to the at least one computer in the set of computers.

20. The data processing system of claim 18, wherein the hierarchy is established according to predefined levels of management policy software resident at respective computers within the network corresponding to levels within the hierarchy.

21. The data processing system of claim 18, further comprising:

a computer network, including a plurality of policy servers, the policy servers arranged into a hierarchy;

a set of computers capable of communicating with the one or more policy servers across the network, the set of computers being arranged into the hierarchy;

wherein the one or more policy servers manage distribution of software or policies for at least one computer in the set of computers; and

wherein a first policy server of the one or more policy servers has management authority only over computers in the set of computers that are below the first policy server in the hierarchy.

22. The system of claim 21, wherein the first policy server inventories the set of computers.

23. The system of claim 21, wherein the first policy server determines a version of the software already present on the at least one computer in the set of computers.

24. The system of claim 21, wherein the software distribution policy determines available software configuration for a user of the at least one computer in the set of computers.

25. The system of claim 21, wherein the first policy server determines a status of the at least one computer in the set of computers, wherein the status comprises at least one of managed or unmanaged and at least one of shared or dedicated.